The @ccfly/setup-darwin-arm64 npm package contains a malicious Go binary that establishes a remote control channel to a hardcoded operator server (cc.hn). This binary enables full host command execution via a WebSocket connection and exfiltrates user Anthropic/Claude API credentials by modifying shell profile files to route API requests through the attacker-controlled infrastructure. The malicious behavior activates when the parent @ccfly/setup CLI invokes the binary, not during npm install alone. The package versions explicitly affected include multiple 0.1.x releases.